node-tesseract: OS command injection in lib/tesseract.js (CVE-2026-117511)
A vulnerability exists in desmondmorris node-tesseract up to 0.2.7 where the process function in lib/tesseract.js is susceptible to OS command injection via the image argument.
CVE search metadata
CVE search record: CVE-2026-117511. Severity: high. CVSS: 7.3. KEV: no. Product: node-tesseract (<= 0.2.7). Brief: node-tesseract: OS command injection in lib/tesseract.js (CVE-2026-117511). Brief link: https://feed.craftedsignal.io/briefs/2026-10-node-tesseract-rce/
Triage facts
Revision 1- Applicability
- node-tesseract (<= 0.2.7)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 18:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. The process function in lib/tesseract.js, part of the Command Builder component, is affected by OS command injection through manipulation of the image argument. The attack can be executed remotely. The exploit has been disclosed to the public, and the project has not responded to an early issue report.